NS8 cluster-admin UI several error notifications

Hi there,

I’ve just started two days ago testing NS8. Looks really promising and feels at late alpha state already really easy an comfortably . Also, the NextSecurity project really catched my interest, I’d love to have a single UI for managing multiple (independant?) “firewall boxes” :heart_eyes:.

I’m really exited about the upcoming public Beta seeming to be in sight and look really forward to test with it, too.

Nevertheless, for today I’ve got a few UI issues I’d like to report. As I’m unsure if a github issue for the alpha release can or should be handed in, I’d rather report here for now.

First of all, details of my testing environment:

* KVM running on Proxmox 7.4-3
* 2 vCPU, 4GB RAM, 32GB disk, UEFI booting 
* LVM  storage layout
      8 GB /, ext4
     10 GB /home, btrfs (thought podman would then use another graphfs driver)
     10 GB /var, btrfs
      2 GB /tmp, ext4
      1 GB swap
    0.5 GB /boot, ext2
    0.5 GB /efi, vfat
* OS Debian 11.7 
* single-node cluster

1. Accessing Settings-> Account immediately produces an error notification that something went wrong. Editing the display name produces the very same error. Enrollment for 2FA works without issues (just afterwards when page is reloaded the inital error occurs again) I did not test the password change functionality by now.

2. Accessing Settings-> Cluster Administrators displays a permanent badge “List cluster Administrators - something went wrong” as well as a notification with the same text.
Creation of new cluster Administrators work perfectly, however.

3. Trying to download a cluster backup results in a notification
“action.download-cluster-backup Something went wrong”
No backup can be downloaded

4. Setting or changing the backup password gives a warning, however afterwards it looks as if a password has been set (at least on first-time usage). I do not know how to verify if the password really has been saved, please advise if you need this information, too.

All of those issues have a quite similar stacktrace when looking at “More info” within the notification. Of course, the context “action” changes:

  1: action="get-user-info" 
  2: action="list-users" 
  3 & 4: action="download-cluster-backup"
Output of "More info"
{
  "context": {
    "action": "download-cluster-backup",
    "data": {
      "password": "_RedActed-pass23"
    },
    "extra": {
      "isNotificationHidden": true,
      "title": "action.download-cluster-backup"
    },
    "id": "7555709a-e08b-4aba-9cf1-656e16b94c49",
    "parent": "",
    "queue": "cluster/tasks",
    "timestamp": "2023-05-04T17:13:13.051470391Z",
    "user": "admin"
  },
  "status": "aborted",
  "progress": 0,
  "subTasks": [],
  "validated": false,
  "result": {
    "error": "Traceback (most recent call last):\n  File \"/usr/local/agent/bin/cluster-backup\", line 78, in <module>\n    dump['cluster']['override']['modules'] = rdb.hgetall('override/modules')\n  File \"/usr/local/agent/pyenv/lib/python3.9/site-packages/redis/client.py\", line 3014, in hgetall\n    return self.execute_command('HGETALL', name)\n  File \"/usr/local/agent/pyenv/lib/python3.9/site-packages/redis/client.py\", line 901, in execute_command\n    return self.parse_response(conn, command_name, **options)\n  File \"/usr/local/agent/pyenv/lib/python3.9/site-packages/redis/client.py\", line 915, in parse_response\n    response = connection.read_response()\n  File \"/usr/local/agent/pyenv/lib/python3.9/site-packages/redis/connection.py\", line 756, in read_response\n    raise response\nredis.exceptions.NoPermissionError: this user has no permissions to access one of the keys used as arguments\n",
    "exit_code": 1,
    "file": "task/cluster/7555709a-e08b-4aba-9cf1-656e16b94c49",
    "output": ""
  }
}

If there is anything else I can/shall provide to you please just tell me (and maybe also where to get the information from as I’ve started just two days ago :slight_smile: )

Last but not least; Thank you very much for the really greate work so far!

5 Likes

Hi Christoph, thank you for the test and the detailed report!

I hit the same problem and I already found the bug: it will be fixed soon.

If you can attach the JSON error strings like you did for download-cluster-backup please do it! They may look similar, but details matter.

1 Like

Thank you for the report Cristoph!

:dart: The community is always the right place to report issues: we can inspect them together and move it to the tracker after gathering all the info.

I can reproduce all the issues. I think this is due to a recenter refactor to improve the security of keys saved on redis.
You can usually see all info inside the journal.
To debug the problems, I usually open journalctl -f inside a console while doing operations on the UI.

Issue 1:

May 05 10:28:34 debian cluster[8483]: Traceback (most recent call last):
May 05 10:28:34 debian cluster[8483]:   File "/var/lib/nethserver/cluster/actions/get-user-info/50get", line 28, in <module>
May 05 10:28:34 debian cluster[8483]:     info = rdb.hgetall('user/' + user)
May 05 10:28:34 debian cluster[8483]:   File "/usr/local/agent/pyenv/lib/python3.9/site-packages/redis/client.py", line 3014, in hgetall
May 05 10:28:34 debian cluster[8483]:     return self.execute_command('HGETALL', name)
May 05 10:28:34 debian cluster[8483]:   File "/usr/local/agent/pyenv/lib/python3.9/site-packages/redis/client.py", line 901, in execute_command
May 05 10:28:34 debian cluster[8483]:     return self.parse_response(conn, command_name, **options)
May 05 10:28:34 debian cluster[8483]:   File "/usr/local/agent/pyenv/lib/python3.9/site-packages/redis/client.py", line 915, in parse_response
May 05 10:28:34 debian cluster[8483]:     response = connection.read_response()
May 05 10:28:34 debian cluster[8483]:   File "/usr/local/agent/pyenv/lib/python3.9/site-packages/redis/connection.py", line 756, in read_response
May 05 10:28:34 debian cluster[8483]:     raise response
May 05 10:28:34 debian cluster[8483]: redis.exceptions.NoPermissionError: this user has no permissions to access one of the keys used as arguments

Issue 2:

May 05 10:29:19 debian cluster[8483]: Traceback (most recent call last):
May 05 10:29:19 debian cluster[8483]:   File "/var/lib/nethserver/cluster/actions/list-users/50list", line 24, in <module>
May 05 10:29:19 debian cluster[8483]:     role = rdb.hget('roles/' + user, 'cluster')
May 05 10:29:19 debian cluster[8483]:   File "/usr/local/agent/pyenv/lib/python3.9/site-packages/redis/client.py", line 3010, in hget
May 05 10:29:19 debian cluster[8483]:     return self.execute_command('HGET', name, key)
May 05 10:29:19 debian cluster[8483]:   File "/usr/local/agent/pyenv/lib/python3.9/site-packages/redis/client.py", line 901, in execute_command
May 05 10:29:19 debian cluster[8483]:     return self.parse_response(conn, command_name, **options)
May 05 10:29:19 debian cluster[8483]:   File "/usr/local/agent/pyenv/lib/python3.9/site-packages/redis/client.py", line 915, in parse_response
May 05 10:29:19 debian cluster[8483]:     response = connection.read_response()
May 05 10:29:19 debian cluster[8483]:   File "/usr/local/agent/pyenv/lib/python3.9/site-packages/redis/connection.py", line 756, in read_response
May 05 10:29:19 debian cluster[8483]:     raise response
May 05 10:29:19 debian cluster[8483]: redis.exceptions.NoPermissionError: this user has no permissions to access one of the keys used as arguments

Issue 4:

May 05 10:25:26 debian cluster[8483]: Traceback (most recent call last):
May 05 10:25:26 debian cluster[8483]:   File "/usr/local/agent/bin/cluster-backup", line 78, in <module>
May 05 10:25:26 debian cluster[8483]:     dump['cluster']['override']['modules'] = rdb.hgetall('override/modules')
May 05 10:25:26 debian cluster[8483]:   File "/usr/local/agent/pyenv/lib/python3.9/site-packages/redis/client.py", line 3014, in hgetall
May 05 10:25:26 debian cluster[8483]:     return self.execute_command('HGETALL', name)
May 05 10:25:26 debian cluster[8483]:   File "/usr/local/agent/pyenv/lib/python3.9/site-packages/redis/client.py", line 901, in execute_command
May 05 10:25:26 debian cluster[8483]:     return self.parse_response(conn, command_name, **options)
May 05 10:25:26 debian cluster[8483]:   File "/usr/local/agent/pyenv/lib/python3.9/site-packages/redis/client.py", line 915, in parse_response
May 05 10:25:26 debian cluster[8483]:     response = connection.read_response()
May 05 10:25:26 debian cluster[8483]:   File "/usr/local/agent/pyenv/lib/python3.9/site-packages/redis/connection.py", line 756, in read_response
May 05 10:25:26 debian cluster[8483]:     raise response
May 05 10:25:26 debian cluster[8483]: redis.exceptions.NoPermissionError: this user has no permissions to access one of the keys used as arguments
May 05 10:25:26 debian cluster[8483]: task/cluster/8753fa23-ecfb-4c1d-b679-eecaec69fe8c: action "download-cluster-backup" status is "aborted" (1) at step 50backup
2 Likes

Thank you for analyzing it Giacomo, I filed a bug card here: Trello

Hi @giacomo and @davidep

Thank you very much for your fast reply and further analysis.
I can confirm that I get exactly the same output in journal as @giacomo at reproduction.

Oh well, did not thought it really is that easy. All right, the next time I’ll be able to deliver even more information the first time :slight_smile:

If there is anything else I can do, e.g. test a fix later on please let me know.

2 Likes

Sorry, have overseen this question last time, here are those outputs, too

JSON output get-user-info

{
“context”: {
“action”: “get-user-info”,
“data”: {
“user”: “admin”
},
“extra”: {
“eventId”: “21c0421c-5f6c-4018-9695-43795adf4261”,
“isNotificationHidden”: true,
“title”: “Get user info”
},
“id”: “c4cc7106-0f17-4ea1-9968-92a6933a7075”,
“parent”: “”,
“queue”: “cluster/tasks”,
“timestamp”: “2023-05-05T12:54:52.023794113Z”,
“user”: “admin”
},
“status”: “aborted”,
“progress”: 0,
“subTasks”: ,
“validated”: false,
“result”: {
“error”: “Traceback (most recent call last):\n File "/var/lib/nethserver/cluster/actions/get-user-info/50get", line 28, in \n info = rdb.hgetall(‘user/’ + user)\n File "/usr/local/agent/pyenv/lib/python3.9/site-packages/redis/client.py", line 3014, in hgetall\n return self.execute_command(‘HGETALL’, name)\n File "/usr/local/agent/pyenv/lib/python3.9/site-packages/redis/client.py", line 901, in execute_command\n return self.parse_response(conn, command_name, **options)\n File "/usr/local/agent/pyenv/lib/python3.9/site-packages/redis/client.py", line 915, in parse_response\n response = connection.read_response()\n File "/usr/local/agent/pyenv/lib/python3.9/site-packages/redis/connection.py", line 756, in read_response\n raise response\nredis.exceptions.NoPermissionError: this user has no permissions to access one of the keys used as arguments\n”,
“exit_code”: 1,
“file”: “task/cluster/c4cc7106-0f17-4ea1-9968-92a6933a7075”,
“output”: “”
}
}

JSON output list-users

{
“context”: {
“action”: “list-users”,
“data”: null,
“extra”: {
“eventId”: “d17a97a9-ddff-427d-aa7e-e093b12093fc”,
“isNotificationHidden”: true,
“title”: “List cluster administrators”
},
“id”: “b7466722-5cbb-4461-ac23-8aa41a8ad67c”,
“parent”: “”,
“queue”: “cluster/tasks”,
“timestamp”: “2023-05-05T12:57:36.111167403Z”,
“user”: “admin”
},
“status”: “aborted”,
“progress”: 0,
“subTasks”: ,
“validated”: false,
“result”: {
“error”: “Traceback (most recent call last):\n File "/var/lib/nethserver/cluster/actions/list-users/50list", line 24, in \n role = rdb.hget(‘roles/’ + user, ‘cluster’)\n File "/usr/local/agent/pyenv/lib/python3.9/site-packages/redis/client.py", line 3010, in hget\n return self.execute_command(‘HGET’, name, key)\n File "/usr/local/agent/pyenv/lib/python3.9/site-packages/redis/client.py", line 901, in execute_command\n return self.parse_response(conn, command_name, **options)\n File "/usr/local/agent/pyenv/lib/python3.9/site-packages/redis/client.py", line 915, in parse_response\n response = connection.read_response()\n File "/usr/local/agent/pyenv/lib/python3.9/site-packages/redis/connection.py", line 756, in read_response\n raise response\nredis.exceptions.NoPermissionError: this user has no permissions to access one of the keys used as arguments\n”,
“exit_code”: 1,
“file”: “task/cluster/b7466722-5cbb-4461-ac23-8aa41a8ad67c”,
“output”: “”
}
}

3 Likes

The fixes were merged, you can test them by installing the core latest tag on a pristine OS:

curl https://raw.githubusercontent.com/NethServer/ns8-core/main/core/install.sh > install.sh 
bash install.sh ghcr.io/nethserver/core:latest

See also

2 Likes

Yes, I can confirm that all four issues are resolved. The tasks run without any issue and the encrypted cluster backup is downloaded correctly. :partying_face:

2 Likes